November 2017 - keycloak-user - Jboss List Archives

OTP Policy updates not reflects in Google Authenticator

by forums.akurathi＠gmail.com

Dear all, We are running into a weird problem i.e., updates to OTP policy does not reflect at google authenticator app. We wonder is there any special instructions needed to get this working. A sequence of steps : 1) create realm, create user 2) enable OTP 3) login with the newly created user 4) system asks you to configure OTP 5) update OTP policy such as number of digits from 6 to 8 6) try login again 7) system asks you to enter OTP but authentication fails We expect the system should route the user to configure OTP page rather than prompting to enter OTP which anyways fails. Your response is highly appreciated !!! Thanks in advance Regards Krishna Kumar Akurathi

7 years, 1 month

2
2
0 / 0

access token valid for more than expiry time by milli seconds

by Rahul R

Hi, We have a keycloak set up where the Access Token Lifespan is set to 5 minutes. Now we get the access token using the following command : curl -d "client_id=admin-cli" -d "username=admin_user" -d "password=admin_user" -d "grant_type=password" " http://192.168.56.101:8080/auth/realms/REALM/protocol/openid-connect/token" Now if we use the following command to get the user details curl -H "Authorization: bearer "access token value got earlier" " http://192.168.56.101:8080/auth/realms/REALM/protocol/ openid-connect/userinfo" The expectation is that the second command works till the token expiry time which is 5 minutes and after 5 minutes the token not valid error should be seen. But while running the tests multiple times, we are seeing that sometimes the token is valid for more than 5 minutes by almost 500 milliseconds. Has anyone seen such a behaviour ? Is this is a keycloak bug or a behaviour only seen in my machine? Thanks Rahul

7 years, 1 month

1
1
0 / 0

LDAP user federation keycloak with .net core

by Athulya Pillai

Hello, Please help me to user keycload LDAP provider in .net core Thanks and Regards Athulya

7 years, 1 month

1
0
0 / 0

Configuring keycloak SAML adapter on tomcat with clockSkew

by Elias Glareff

Hello, I am trying to track down the information whether it is possible to set the clockSkew in the keycloak tomcat adapter. The problem is that Identity Provider is some time ahead of the Service Provider, so whenever the SAML response arrives, the NotBefore time is ahead of the SP clock, so the response is considered expired on arrival. This is a known problem, described in https://medium.com/@PrakhashS/saml-assertion-condition-notbefore-notonora.... In the keycloak source code in AssertionUtil there is a method hasExpired to which you can provide a clockSkew variable which would remedy this problem. The issue is that I see absolutely no place where I could let the keycloak SAML adapter on the service provider know that I want to use a clock skew and set it's value. The only configuration from my side I see is the keycloak-saml.xml in the WEB-INF folder of the application, but in the documentation for this configuration it does not mention any possibility to set the clock skew. Kindly share your knowledge on this issue if you can help. Thanks, Elias

7 years, 1 month

2
1
0 / 0

AuthZ with realm roles

by Corentin Dupont

Hi guys, yet another question... AuthZ is quite mysterious! I am trying to protect my API with realm roles. I have an API looking like this: http://www.example.com/api/v1/cities/rome/houses http://www.example.com/api/v1/cities/rome/streets Each endpoint supports GET/PUT/POST/DELETE. Each role must have the form: <view|manage>:<asset>[:<city>[:<resource filter>]] For example roles can be: - view:houses - view:houses:rome - view:houses:rome:owner==smith - manage:houses:rome "manage": gives you all CRUD operations, while with "view" you can only read resources. Do you think this design is correct? Any other suggestion? What is not practical is that I have to force my users to use this role format. The resource filter part is also hard to implement, has it requires to check the content of the responses...

7 years, 1 month

2
1
0 / 0

example authz photos not working

by Max Bruchmann

Hi, maybe I'm doing something wrong but it looks like instructions of the photoz example are not working. When importing the Authorization Setting "examples/authz/photoz/photoz-restful-api/src/main/resources/photoz-restful-api-authz-service.json" the "Only Owner Policy" entry contains "${project.version}" which leads to a failed import. It works with the processed version in target/classes since it is replaced during the build. Also as the "Only Owner Policy" is a maven entry and its pom depends on the parent and the parent on its parent you need to do mvn install in the root example folder. The only thing I was not able to work arround was the deploying is the actual deployment of the photoz-restful-api When I execute: cd examples/authz/photoz/photoz-restful-api mvn clean package wildfly:deploy It results in: [ERROR] Failed to execute goal org.wildfly.plugins:wildfly-maven-plugin:1.1.0.Final:deploy (default-cli) on project photoz-restful-api: Failed to execute goal deploy: {"WFLYCTL0062: Composite operation failed and was rolled back. Steps that failed:" => {"Operation step-1" => {"WFLYCTL0080: Failed services" => {"jboss.module.service.\"deployment.photoz-restful-api.war\".main" => "WFLYSRV0179: Failed to load module: deployment.photoz-restful-api.war [ERROR] Caused by: org.jboss.modules.ModuleNotFoundException: org.keycloak.keycloak-authz-client"}}}} And the log on the server side: 00:20:22,098 ERROR [org.jboss.msc.service.fail] (MSC service thread 1-1) MSC000001: Failed to start service jboss.module.service."deployment.photoz-restful-api.war".main: org.jboss.msc.service.StartException in service jboss.module.service."deployment.photoz-restful-api.war".main: WFLYSRV0179: Failed to load module: deployment.photoz-restful-api.war at org.jboss.as.server.moduleservice.ModuleLoadService.start(ModuleLoadService.java:91) at org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:2032) at org.jboss.msc.service.ServiceControllerImpl$StartTask.run(ServiceControllerImpl.java:1955) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) at java.lang.Thread.run(Thread.java:748) Caused by: org.jboss.modules.ModuleNotFoundException: org.keycloak.keycloak-authz-client at org.jboss.modules.Module.addPaths(Module.java:1217) at org.jboss.modules.Module.link(Module.java:1573) at org.jboss.modules.Module.relinkIfNecessary(Module.java:1601) at org.jboss.modules.ModuleLoader.loadModule(ModuleLoader.java:287) at org.jboss.modules.ModuleLoader.loadModule(ModuleLoader.java:271) at org.jboss.as.server.moduleservice.ModuleLoadService.start(ModuleLoadService.java:68) ... 5 more So if I understand it correctly there is no authz client module installed on keycloak. How do I solve this? Kind Regards, Max

7 years, 1 month

2
1
0 / 0

Required user actions dropdown no longer working for user admin users because of missing select2.css

by Edgar Vonk - Info.nl

Hi, I think in a recent upgrade of Keycloak (we are now using 3.2.0.Final) the following issue was introduced: When a ‘user admin user’ (this is a realm user who has permissions to manage and view users in Keycloak) logs in to Keycloak and this persion tries to add a new user the ‘required user actions’ dropdown is mangled and does not function properly. This seems to be caused by a permission issue or something regarding the ‘select2.css’ resource. In the browser I see that the select2.css file cannot be loaded. However when an overall Keycloak admin logs in this dropdown just works fine. Shall I report a JIRA issue for this? I do not really know what causes this but my guess is that the manage / view user roles in Keycloak are missing some permissions somewhere. These are the permissions the user admin user has: - manage-users - view-clients - view-realm - view-users cheers Edgar

7 years, 1 month

1
1
0 / 0

Geeting user mapped attributes

by Atienzar Navarro, Marcial

Hello, I've configure wildfly adapter, and I'm trying to get access to user mapped atriubutes with this code: private String getDniFromAccessToken() { String dni = null; Principal httpPrincipal = request.getUserPrincipal(); if (httpPrincipal instanceof KeycloakPrincipal) { KeycloakPrincipal<KeycloakSecurityContext> kp = (KeycloakPrincipal<KeycloakSecurityContext>) httpPrincipal; AccessToken token = kp.getKeycloakSecurityContext().getToken(); LOGGER.info("JWT {}",kp.getKeycloakSecurityContext().getTokenString()); LOGGER.info("JWT ID {}",kp.getKeycloakSecurityContext().getIdTokenString()); // Puede que no tengamos todavÃa el token if (token != null) { // LOGGER.info("Email {}",token.getEmail()); LOGGER.info("Tenemos un token de keycloak con el que podemos consultar sus atributos"); Map<String, Object> atributos = token.getOtherClaims(); if (atributos != null && !atributos.isEmpty()) { if(LOGGER.isInfoEnabled()){ for(Map.Entry<String,Object> atts : atributos.entrySet()){ LOGGER.info("Atributos del token {} - {}",atts.getKey(),atts.getValue()); } } if (atributos.containsKey("dni")) { dni = String.valueOf(atributos.get("dni")); LOGGER.info("DINI recuperado de keycloak {}", dni); } } else { LOGGER.info("No nos llegan atributos de keycloak"); } } else { LOGGER.info("No tenemos el ID del token de Keycloak"); } } return dni; } I've try with getIdToken and getToken, but I only retrieve client_session. Is it possible to get this user mapped attributes? -- Marcial Atiénzar Navarro Desarrollo Avda. Real Monasterio de Poblet, 20 46930 Quart de Poblet (Valencia) Tél.: +34 96 184 92 49 (corto 1249) Móvil: +34 629 201 240 (corto 44249) matienzar(a)umivale.es<mailto:matienzar@umivale.es> www.umivale.es<http://www.umivale.es>

7 years, 1 month

1
0
0 / 0

keycloak client protocol mapper (script mapper) to add request header into token

by Shane Rowatt

When I'm requesting a token from keycloak I want a specific header value (or extra form data) that was supplied in the request to be put in the JWT payload of the generated token. I've tried using a Script Mapper to get access to header values but I can't see how to get access to header values or data in the form data sent in any of the available script variables: user, realm, userSession, keyclockSession. I was hoping I could use a script something like this: httpRequest.getHeader('X-CID');

7 years, 2 months

1
0
0 / 0

Keycloak as SSO

by Stephen Henrie

When running a Keycloak instance as a localhost using the default H2 database backend, I have been successful at configuring SSO identity providers across Keycloak realms, so that one primary realm acts as the identity provider and the other realms are authenticating against that primary realm using an IP link. However, when I try to do the same thing in our cloud environment using a Postgres database backend, I am getting the generic "Invalid username or password." error which happens during the default first broker login authorization sequence. I have some debugging info below. Can someone help me understand what it is trying to tell me? I believe that I have things configured exactly the same in both my localhost and in the cloud instances, so I am struggling to understand the source of the problem. Any help is appreciated. Thanks Stephen 21:42:30,974 DEBUG [org.keycloak.authentication.DefaultAuthenticationFlow] (default task-50) processFlow 21:42:30,974 DEBUG [org.keycloak.authentication.DefaultAuthenticationFlow] (default task-50) check execution: idp-review-profile requirement: DISABLED 21:42:30,974 DEBUG [org.keycloak.authentication.DefaultAuthenticationFlow] (default task-50) execution is processed 21:42:30,975 DEBUG [org.keycloak.authentication.DefaultAuthenticationFlow] (default task-50) check execution: idp-create-user-if-unique requirement: ALTERNATIVE 21:42:30,975 DEBUG [org.keycloak.authentication.DefaultAuthenticationFlow] (default task-50) authenticator: idp-create-user-if-unique 21:42:30,975 DEBUG [org.keycloak.authentication.DefaultAuthenticationFlow] (default task-50) invoke authenticator.authenticate: idp-create-user-if-unique 21:42:30,975 WARN [org.keycloak.services] (default task-50) KC-SERVICES0020: Email is null. Reset flow and enforce showing reviewProfile page 21:42:30,975 DEBUG [org.keycloak.authentication.AuthenticationProcessor] (default task-50) RESET FLOW 21:42:30,975 DEBUG [org.keycloak.authentication.AuthenticationProcessor] (default task-50) AUTHENTICATE 21:42:30,975 DEBUG [org.keycloak.authentication.AuthenticationProcessor] (default task-50) AUTHENTICATE ONLY 21:42:30,975 DEBUG [org.keycloak.authentication.DefaultAuthenticationFlow] (default task-50) processFlow 21:42:30,975 DEBUG [org.keycloak.authentication.DefaultAuthenticationFlow] (default task-50) check execution: idp-review-profile requirement: DISABLED 21:42:30,975 DEBUG [org.keycloak.authentication.DefaultAuthenticationFlow] (default task-50) execution is processed 21:42:30,975 DEBUG [org.keycloak.authentication.DefaultAuthenticationFlow] (default task-50) check execution: idp-create-user-if-unique requirement: ALTERNATIVE 21:42:30,975 DEBUG [org.keycloak.authentication.DefaultAuthenticationFlow] (default task-50) authenticator: idp-create-user-if-unique 21:42:30,975 DEBUG [org.keycloak.authentication.DefaultAuthenticationFlow] (default task-50) invoke authenticator.authenticate: idp-create-user-if-unique 21:42:30,975 WARN [org.keycloak.services] (default task-50) KC-SERVICES0013: Failed authentication: org.keycloak.authentication.AuthenticationFlowException: Not found serialized context in clientSession at org.keycloak.authentication.authenticators.broker.AbstractIdpAuthenticator.authenticate(AbstractIdpAuthenticator.java:66) at org.keycloak.authentication.DefaultAuthenticationFlow.processFlow(DefaultAuthenticationFlow.java:200) at org.keycloak.authentication.AuthenticationProcessor.authenticateOnly(AuthenticationProcessor.java:843) at org.keycloak.authentication.AuthenticationProcessor.authenticate(AuthenticationProcessor.java:714) at org.keycloak.authentication.DefaultAuthenticationFlow.processResult(DefaultAuthenticationFlow.java:264) at org.keycloak.authentication.DefaultAuthenticationFlow.processFlow(DefaultAuthenticationFlow.java:201) at org.keycloak.authentication.AuthenticationProcessor.authenticateOnly(AuthenticationProcessor.java:843) at org.keycloak.authentication.AuthenticationProcessor.authenticate(AuthenticationProcessor.java:714) at org.keycloak.services.resources.LoginActionsService.processFlow(LoginActionsService.java:279) at org.keycloak.services.resources.LoginActionsService.brokerLoginFlow(LoginActionsService.java:713) at org.keycloak.services.resources.LoginActionsService.firstBrokerLoginGet(LoginActionsService.java:632) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) 21:42:30,976 WARN [org.keycloak.events] (default task-50) type=IDENTITY_PROVIDER_FIRST_LOGIN_ERROR, realmId=experiment, clientId=chassi-web-app, userId=null, ipAddress=172.17.0.1, error=invalid_user_credentials, identity_provider=chassi-oidc, auth_method=openid-connect, redirect_uri=http://localhost:3000/, identity_provider_identity=abfa50e5-57ad-4b53-ab72-7cbd6fca8465, code_id=60963d99-cf55-4e0a-8e28-df0ddacadf5f 21:4

7 years, 2 months

1
1
0 / 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

keycloak-user November 2017